Strengthen JobProtocol model after independent review.

Replace tautological invariants with non-trivial ones, allow multi-shot
coordination loss and re-partition, fix reap/progress lifecycle, enable
deadlock checking via Done, and add stress and multi-shot TLC configs.

docs/protocol/RemoraDurableFault.cfg

@@ -1,8 +1,9 @@
 SPECIFICATION SafetySpec
 
-CHECK_DEADLOCK FALSE
+CHECK_DEADLOCK TRUE
 
 \* Worker can reach coordination and target while durable authority is cut.
+\* Single worker: CrashWorker disabled (OtherCapacity); partitions only.
 CONSTANTS
     Jobs = {j1}
     Workers = {w1}
@@ -16,19 +17,21 @@ CONSTANTS
     GlobalLimit = 1
     FaultsEnabled = TRUE
     FaultServices = {"Durable"}
+    MaxCoordLosses = 0
+    MaxPartitions = 2
 
 INVARIANTS
     TypeOK
     StateConsistency
-    AtMostOneAuthoritativeAttempt
-    FencingTokensUnique
+    AllocatedTokensUsed
+    LiveProgressAligned
+    AtMostOneLiveLeasePerJob
+    AuthorityWellFormed
     CommittedResultConsistent
     CancellationSafety
     PermitSafety
-    QueueRecoverable
-    AttemptIsolation
     ResumeValidity
-    ZombieIsolation
+    StagingOwnership
 
 PROPERTIES
     TerminalStateIsImmutable